%MDSECDS
Generates authorization data sets. This is the top-level
macro (it calls the underlying macros and should be used on its own).
Used by: |
Security reporting |
Type: |
Stand-alone |
Requirement: |
Connection to the metadata server |
Syntax
%MDSECDS
(OUTDATA=data-set,
<FOLDER="path">,
<INCLUDESUBFOLDERS=YES
| NO>,
<INCLUDETABLECOMPONENTS=YES | NO>,
<INCLUDECUBECOMPONENTS=YES
| NO>,
<INCLUDESECUREDTABLES=YES | NO>,
<MEMBERTYPES="list">,
<MEMBERFILTER="expression">,
<PERMS="list">,
<IDENTITYNAMES="list">,
<IDENTITYTYPES="list">);
Optional Arguments
- OUTDATA
-
provides a base name
for the output. By default, the base name is work.mdsecds
.
- FOLDER
-
identifies a starting
point folder. By default, the starting point is the server root (the SAS
Folders node). If you provide a path (such as "\Products\SAS
Intelligence Platform\Samples"
), the starting point
is the last folder in the path. To avoid having to type a long pathname,
copy the path from a child item's general properties into your code.
- INCLUDESUBFOLDERS
-
controls whether the
entire subtree is included. By default, all objects in the entire
subtree are included. If you specify NO
,
only the immediate contents of the starting point folder are included.
- INCLUDETABLECOMPONENTS
-
controls whether table
columns are included when a table is returned. By default, columns
are included.
- INCLUDECUBECOMPONENTS
-
controls whether cube
hierarchies, levels, and dimensions are included when a cube is returned.
By default, these components are included.
- INCLUDESECUREDTABLES
-
controls whether secured
table objects are included when a secured library object is returned.
By default, secured table objects are included.
- MEMBERTYPES
-
limits by object type.
By default, all public types are included. If you provide a comma-delimited
list of types, only those types are included.
You must provide the
public type name in its TypeName format. For example, if you access
the
Advanced tab in the properties dialog
box for the
Information Map (relational)
object type, you will see that its TypeName is
InformationMap.Relational
.
Tip
In SAS Management Console,
all public types are displayed on the
Folders
tab under
SystemTypes.
Note: If you use this option, examine
the output. The log doesn't display errors or warnings for incorrectly
specified types.
- MEMBERFILTER
-
limits by metadata
attribute value. By default, no filter is applied. If you provide
an expression, only objects that meet the criteria are included. The
format for the expression is @attribute-name comparison-operator
'value' (for example, @ID='A5HDAJSI.B90006Y5'
or @Name=:'Salary'
).
Comparison operators
for character data include
=
(equals),
=:
(begins
with),
?
(contains), and
ne
(not
equals).
Metadata attributes
are associated with an object's metadata type (not public type). Here
are two common attributes:
ID |
is the object's metadata ID, which is displayed
on the object's Inheritance tab.
|
Name |
is the object's name, which is displayed in the Name
field on the object's General tab.
|
To find additional
attributes, determine the MetadataType of the object that you are
interested in. The type is displayed on the object's
Inheritance
tab. Then, in the reference documentation for the metadata model,
look up that MetadataType to find the names of its attributes.
- PERMS
-
specifies which permissions
to include. By default, all permissions that are supported for each
object type are included for objects of that type. If you provide
a comma-delimited list of permissions, only those permissions are
included. Even if the permissions in your user interface are translated,
you must specify the English-language permission names (for example,
ReadMetadata).
- IDENTITYNAMES
-
specifies which identities
to include. By default, only the named participants (the identities
that are listed in an object's authorization properties) are included.
If you provide a comma-delimited list of identity names, only those
identities are included. List identities by their names, not their
display names.
If you use this option,
you must also use the IDENTITYTYPES option.
- IDENTITYTYPES
-
specifies whether names
in the IDENTITYNAMES list correspond to users or to groups. For example,
the first name listed in the IDENTITYNAMES parameter must match the
first value in the IDENTITYTYPES list. Valid values in this list are Person
and IdentityGroup
.
Examples
Example 1: Permissions for All Objects within a Folder
This code extracts information
about permissions on the objects in the Sales folder but doesn't include
objects in subfolders:
%mdsecds(folder="\Shared Data\Sales", includesubfolders=no);
Example 2: Permissions for Two Object Types within a Folder Branch
This code extracts information
about permissions on tables and schemas in the Sales folder and its
subfolders:
%mdsecds(folder="\Shared Data\Sales", membertypes="Library,OLAPSchema");
Example 3: ReadMetadata Permission for Libraries for a Specified User
This code extracts information
that indicates which libraries a particular user (the SAS Demo User)
can see:
%mdsecds(identitynames="sasdemo", identitytypes="Person", membertypes="Library",
perms="ReadMetadata");
Example 4: ReadMetadata Permission for Stored Processes for Two Specified
Users
This code extracts information
that indicates which stored processes two users (the SAS Demo User
and Tara O'Toole) can see:
%mdsecds(identitynames="sasdemo,totoo", identitytypes="Person,Person",
membertypes="StoredProcess", perms="ReadMetadata");
Example 5: WriteMetadata Permission for Reports for Specified Identities
This code extracts information
that indicates which reports one user and one group (the SAS Demo
User and PUBLIC) can modify:
%mdsecds(identitynames="sasdemo,PUBLIC", identitytypes="Person,IdentityGroup",
membertypes="Report", perms="WriteMetadata");
Example 6: ReadMetadata Permission for a Subset of Reports
This code extracts information
that indicates who can view reports that include the word "Salary"
in their names:
%mdsecds(membertypes="Report", perms="ReadMetadata", memberfilter="@Name ? 'Salary'");
Example 7: Permissions for an Object (Referenced by Object ID)
This code extracts permission
settings for an object that is referenced by its object ID:
%mdsecds(memberfilter="@ID='A5HDAJSI.B90006Y5'");
Note: Member filters are not applied
to folders, so this example returns all folders (in addition to the
object that has the specified ID).